Detection, Analysis, and Countermeasures for Radio Transceivers

ABSTRACT

A computer-implementable method employs network signal metadata to train a cognitive learning and inference system to produce an inferred function, wherein the metadata comprises a syntactic structure of at least one network communication protocol. The inferred function is used to map metadata of a detected network signal to a cognitive profile of a transmitter of the detected network signal. The mapping effects intelligent discrimination of the transmitter from at least one other transmitter through corroborative or negating evidentiary observation of properties associated with the metadata of the detected network signal. Information content in the network signal can be determined from the inferred function or the cognitive profile without demodulating the network signal.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation of U.S. patent application Ser. No.17/340,712, filed on Jun. 7, 2021, now U.S. Pat. No. 11,595,149; whichis a Continuation of U.S. patent application Ser. No. 16/157,615, filedon Oct. 11, 2018, now U.S. Pat. No. 11,032,022; which claims priorityunder 35 U.S.C. 119(e) to U.S. Provisional Application Ser. No.62/570,768, filed Oct. 11, 2017; all of which are incorporated byreference in their entireties.

BACKGROUND I. Field

The present invention relates to detecting, identifying, tracking, andenacting countermeasure against remote-controlled vehicles, such asunmanned autonomous vehicles (UAVs).

II. Background

The background description includes information that may be useful inunderstanding the present inventive subject matter. It is not anadmission that any of the information provided herein is prior art orrelevant to the presently claimed inventive subject matter, or that anypublication, specifically or implicitly referenced, is prior art.

Techniques for disabling a UAV can include jamming its control signalwith high-power radio frequency (RF) signals. Jamming is aPhysical-Layer denial-of-service (DoS) attack that relies on transmittedradio signals to interfere with wireless transmissions whereby theattacker essentially spams the appropriate RF band with a much strongersignal than those used for network communications.

A UAV operator might employ an unconventional, and possibly unique,radio protocol to evade detection and countermeasures. Thus, there is aneed in the art for a UAV detection, analysis, and countermeasure systemcapable of detecting, identifying, and responding to UAVs that employunanticipated communication protocols. It would be useful for such asystem to adapt to and learn from the devices it detects, such as toimprove detection, identification, and/or countermeasures. Furthermore,a UAV operator might employ an autopilot or waypoint mode in which thereis little to no radio communication between a UAV and its controller.Thus, there is a need for a UAV countermeasure system capable ofconfiguring exploits to target a UAV system in which little to noinitial information about its radio protocol is known.

One of the most difficult problems in Signals Intelligence is detecting,analyzing, and characterizing unknown signals. In large part, thedifficulty stems from how most RF applications work—systems rely onprior knowledge to create a filter that detects a specific signal.Generally, human operators are needed to detect unknown signals, performtime consuming analysis, and develop a detection and demodulation schemebefore downstream processing tasks occur. The human-driven approach cantake weeks or months to complete. This means that new signal detectionand analysis for electronic warfare and signal detection can become amajor bottleneck for operations and intelligence gathering.

Cognitive radio has focused primarily on developing algorithms andcapabilities that enable radios to be more aware of their environment.This awareness permits the radios to operate more effectively byperforming auto-tuning, managing auto gain, detecting busy channels,finding open channels, and managing noise. During the last decade, moreresearchers have focused on using Machine Learning (ML) tools andtechniques. ML, sometimes referred to as artificial intelligence (AI),expands and extends what cognitive radios can do. Some of these effortshave focused on developing complex algorithms to perform blind signaldetection and/or blind signal analysis. The term ‘blind’ is used toindicate that the algorithm or system has little prior knowledge aboutthe signals it is monitoring, such as specific frequencies or modulationschemes. However, no single algorithm has been found that is effectiveat blindly analyzing and managing all types of signals, frequencies,waveforms, and modulation types, and in all types of propagationenvironments (i.e., channels).

SUMMARY

Aspects disclosed herein pertain to a distributed sensor network, suchas may be employed for detecting, tracking, identifying, and/ormitigating UAVs, such as unmanned aerial vehicles, autonomouslynavigated vehicles, and wireless remote-controlled vehicles. Suchaspects may be applied broadly to distributed networks, such as Internetof Things (IoT) networks, wireless communications networks (e.g., radioaccess networks employed in any of the cellular standards, wirelesslocal area network standards, personal area communications standards,vehicular access network standards), autonomous vehicle controlnetworks, navigation systems, as well as other networks and systems.

Distributed networks present unique and complex resource and serviceinteractions. For example, classification of data may take place at ananalytics engine, such as a perceptual computing analytics, a sensordata analytics, and the like. Analytics engines may be hosted by aserver in a cloud, at an edge processor (e.g., an edge server, a clientdevice, remote sensors, other edge devices), or both.

The disposition of the data, such as analysis results, may be used byedge devices to provision an action, such as identifying a target UAV,geo-locating a UAV, geo-locating a UAV controller, tracking the UAV,identifying a cluster master in a swarm of UAVs, intercepting signalsfrom a UAV, identifying jamming and other radio interference sources,identifying spoofed radio signals, excising undesired signals (e.g.,interference, jamming, and/or other co-channel interference) fromsignals of interest, geo-locating jammers, spoofers, and/or other radiointerference sources, enacting electronic countermeasures, and the like.The analytics engine may pre-trained through supervised machine learningusing a set of predefined training data, such as pre-classified signals,data patterns, and the like.

A set of analytics engines hosted on multiple geographically distributededge devices introduces certain challenges to classifying signals in aradio propagation environment. For example, sensors on different edgedevices experience different channel conditions and receive differentradio signals. In a hidden-node scenario, for example, an edge devicemight detect a UAV video uplink signal but not the downlink signaltransmitted by the controller to the UAV. Proximity to interferencesources, effects of multipath, and other local channel conditions candegrade radio reception at an edge device. Furthermore, sensor dataanalytics of a particular type might be suitable for some edge devicesand unsuitable for other edge device due to their local channelconditions. Accordingly, aspects disclosed herein can provide aplurality of different data analytic techniques to be provisioned byeach edge device based on at least its local channel conditions. Theanalysis results can be advantageously fused to provide for improvedclassification accuracy. Thus, some techniques described herein providea method for an analytics engine hosted by an edge server to perform afirst type of analysis based on first measured channel conditions, andperform a second type of analysis based on second measured channelconditions. Some techniques described herein provide a method ofcombining results from the first type of analysis performed by a firstedge server with results from the second type of analysis performed by asecond edge server in order to compute a classification (e.g., acognitive profile, a cognitive insight, and the like).

In one aspect, a distributed machine-learning environment is providedamongst the edge devices to fuse at least some analysis results withoutrequiring a remote central processor, such as a data center.

An analytics engine hosted by a central (e.g., cloud) server may use amore powerful model then an edge server, enabling classification usinglower quality data. This central analytics engine may be trained usingdeep learning neural networks and a much larger training data set.Further, the cloud server may have significantly higher computing powerand storage capacity compared to an edge server, allowing the operationof more powerful models. However, communication and processing latencyshould be considered, and the central-processing analytics resourceshould be provisioned in order to reduce negative impacts ofclassification delay on the objectives of the system. Thus, aspectsdisclosed herein provide for enabling edge devices to decide uponwhether cloud processing is to be performed, and possibly which analyticprocessing is to be performed by the cloud. In one aspect, edge devicesassess a target's speed and heading toward a protected area, compute arequired decision time, compare the required decision time to cloudlatency, and based on the comparison, either provision or bypass cloudanalytics.

An edge server hosted analytics engine may provide near real-timeactionable feedback to other edge servers in close network proximity.For example, an edge server may be connected to other edge serversthrough a fronthaul network with minimal network hops. In such aspects,a set of edge servers in close network proximity may self-organize as anetwork cluster to fuse analysis results from each edge server togenerate a classification (e.g., a cognitive profile, a cognitiveinsight, etc.). In further aspects, edge servers may be configured toretrain each other and may disseminate supplemental or a new set oftraining data among themselves. Thus, some techniques described hereinprovide a method for an analytics engine hosted by an edge server toassist in training of an analytics engine hosted by another edge server.

The techniques may be used in any number of analytics engines, forexample, in perceptual computing analytics or edge server hostedanalytics engine/artificial intelligence, among others.

In one aspect of the disclosure, a computer-implementable method forgenerating a cognitive insight is performed by a counter-UAV system. Themethod comprises receiving training data based upon sensor measurementsof at least one unmanned autonomous vehicle for processing in acognitive learning and inference system. The system performs a pluralityof machine learning operations on the training data to generate acognitive profile of the at least one UAV. A cognitive insight isgenerated based upon the cognitive profile, and a countermeasure may beenacted against the UAV based upon the cognitive insight.

Distributed radio system, as well as other systems and methods that arerelevant to this disclosure, is disclosed in U.S. Pat. Pub. No.20150244430 and U.S. Pat. No. 8,670,390, which are incorporated byreference in their entireties. Software-defined radios, as well as othersystems and methods that are relevant to this disclosure, are disclosedin U.S. Pat. Pub. Nos. 20150244430 and 20110292976, and U.S. Pat. No.8,942,082, which are incorporated by reference in their entireties.Aspects of the disclosure can include blind-adaptive techniques andother apparatus and method embodiments disclosed in U.S. Pat. No.7,965,761, which is incorporated by reference in its entirety. U.S.patent application Ser. Nos. 15/279,425, 62/233,982, 15/347,415,15/268,992, and 15/218,609, and U.S. Pat. No. 8,254,847 are incorporatedby reference in their entireties.

Groupings of alternative elements or aspect of the disclosed subjectmatter disclosed herein are not to be construed as limitations. Eachgroup member can be referred to and claimed individually or in anycombination with other members of the group or other elements foundherein. One or more members of a group can be included in, or deletedfrom, a group for reasons of convenience and/or patentability. When anysuch inclusion or deletion occurs, the specification is herein deemed tocontain the group as modified, thus fulfilling the written descriptionof all Markush groups used in the appended claims.

All methods described herein can be performed in any suitable orderunless otherwise indicated herein or otherwise clearly contradicted bycontext. The use of any and all examples, or exemplary language (e.g.,“such as”) provided with respect to certain aspects herein is intendedmerely to better illuminate the inventive subject matter and does notpose a limitation on the scope of the inventive subject matter otherwiseclaimed. No language in the specification should be construed asindicating any non-claimed element as essential to the practice of theinventive subject matter.

Additional features and advantages of the invention will be set forth inthe description which follows, and in part will be obvious from thedescription, or may be learned by practice of the invention. Thefeatures and advantages of the invention may be realized and obtained bymeans of the instruments and combinations particularly pointed out inthe appended claims. These and other features of the invention willbecome more fully apparent from the following description and appendedclaims, or may be learned by the practice of the invention as set forthherein.

BRIEF DESCRIPTION OF THE DRAWINGS

Flow charts depicting disclosed methods comprise “processing blocks” or“steps” may represent computer software instructions or groups ofinstructions. Alternatively, the processing blocks or steps mayrepresent steps performed by functionally equivalent circuits, such as adigital signal processor or an application specific integrated circuit(ASIC). The flow diagrams do not depict the syntax of any particularprogramming language. Rather, the flow diagrams illustrate thefunctional information one of ordinary skill in the art requires tofabricate circuits or to generate computer software to perform theprocessing required in accordance with the present disclosure. It shouldbe noted that many routine program elements, such as initialization ofloops and variables and the use of temporary variables are not shown. Itwill be appreciated by those of ordinary skill in the art that unlessotherwise indicated herein, the particular sequence of steps describedis illustrative only and can be varied. Unless otherwise stated, thesteps described below are unordered, meaning that the steps can beperformed in any convenient or desirable order.

FIG. 1 is a block diagram of a distributed sensing and computing networkin accordance with an exemplary aspect of the disclosure.

FIG. 2 is a block diagram of a machine-learning system implemented inaccordance with aspects disclosed herein.

FIG. 3A is a flow diagram of a computer-implementable method performedby a UAV-detection network configured for generating a cognitiveinsight.

FIG. 3B is a flow diagram depicting a disclosed technique that can beemployed for detecting, identifying, and characterizing unknown signalsvia signal features and meta features using machine learning.

FIG. 4A is a flow diagram that depicts a cognitive learning method inaccordance with aspects of the disclosure.

FIG. 4B is a flow diagram that illustrates a classification method thatcan be performed in accordance with certain aspects of the disclosure.

FIG. 5 is a flow diagram according to one aspect of the disclosure.

DETAILED DESCRIPTION

Various aspects of the disclosure are described below. It should beapparent that the teachings herein may be embodied in a wide variety offorms and that any specific structure, function, or both being disclosedherein are merely representative. Based on the teachings herein oneskilled in the art should appreciate that an aspect disclosed herein maybe implemented independently of any other aspects and that two or moreof these aspects may be combined in various ways. For example, anapparatus may be implemented or a method may be practiced using anynumber of the aspects set forth herein. In addition, such an apparatusmay be implemented or such a method may be practiced using otherstructure, functionality, or structure and functionality in addition toor other than one or more of the aspects set forth herein.

In the following description, for the purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the invention. It should be understood, however, thatthe particular aspects shown and described herein are not intended tolimit the invention to any particular form, but rather, the invention isto cover all modifications, equivalents, and alternatives falling withinthe scope of the invention as defined by the claims.

FIG. 1 is a drawing of a distributed sensing and computing network inwhich aspects of the disclosure can be employed. By way of example, butwithout limitation, a cloud 120 is communicatively coupled with a numberof edge devices 101-110 in accordance with some aspects. The cloud 120may represent the Internet, a local area network (LAN), and/or a widearea network (WAN). The cloud 120 may comprise fronthaul and backhaulnetworks. The cloud 120 can comprise a radio access network, such as a4G, 5G, 6G, or similar wireless technologies standardized undertelecommunications standards associations, such as the 3rd GenerationPartnership Project (3GPP). The cloud 120 can comprise other wirelessnetworks, such as mobile radio networks employed as vehicular areanetworks (VANs) (including vehicular ad-hoc networks, airborne relaynetworks, and the like), cooperative wireless networks, mesh networks,60-GHz networks, and hybrid networks comprising multiple types ofnetwork access technologies, access points, and/or relay platforms.

The edge devices 101-110 may include any number of different types ofdevices grouped in various combinations. By way of example, but withoutlimitation, the edge devices 101-110 can comprise radio receiversconfigured to detect radio signals in a predetermined geographical areaor airspace and may be further configured to identify radio sources,track the radio sources, and possibly enact electronic countermeasuresagainst radio sources that are determined to be a threat to assets in ornear the predetermined geographical area or airspace. In some aspects,the edge devices 101-110 may be configured as components in anair-traffic control (ATC) system.

The edge devices 101-110 can comprise processing resources to performdata analytics. Analytics engines hosted by edge devices 101-110 mayoperate in conjunction with analytics engines hosted on cloud servers204. Cloud servers 204 may employ analytics engines to operate on datacollected by the edge devices 101-110 and may operate on analysisresults produced by analytics engines hosted on edge devices 101-110.Cloud servers 204 may communicatively couple to the cloud 120 to providedata analytics services and the like to edge devices 101-110. In someaspects, Cloud servers 204 may couple to remote information sources viathe cloud, such as (but not limited to) databases, third-party dataservices, media content, and/or remote sensors of various types.

Edge devices 101-110 may include Internet of Things (IoT) devices. Edgedevices 101-110 can include radio transceivers, infrared sensors,chemical sensors, radiological sensors, bio-hazard sensors, acousticsensors, cameras, radars, lidars, thermal sensors, weather sensors, andthe like. Edge devices 101-110 can include navigation signal receivers,such as receivers configured to receive navigation signals fromsatellites and/or navigation beacons. Edge devices 101-110 can includepersonal communication devices (e.g., cellular handsets, user terminals,user equipments (UEs), personal digital assistants, wearable computingdevices, wireless personal area network devices, personal computingdevices, computer peripheral devices, and the like), environmentalsensors, computers (e.g., client computers, servers, etc.), navigationdevices (e.g., GPS or other navigation devices), embedded devices,vehicular wireless communication devices, cellular (e.g., Long TermEvolution (LTE) or the like) network infrastructure transceivers,Internet Service Provider (ISP) network infrastructure modems, routers,access points, base transceiver stations, eNodeBs, remote radio heads,airborne relays, airborne sensors, and the like. The edge devices101-110, or subgroups thereof, may be in communication with the cloud120 through wireless links 208, such as radio access network links andthe like. Furthermore, a sub-network using wired or wireless links, mayallow the edge devices 101-110 to communicate with each other, such asvia a local area network, a wireless local area network, and the like.

The edge devices 101-110 may use a network device, such as a gateway111, to communicate with the cloud 120. In some examples, a sub-networkmay couple one or more of the edge devices 101-110 to the gateway 111using a wired and/or wireless connection. Any of the edge devices101-110 and/or the gateway 111 may host an analytics engine foranalyzing data from the edge devices 101-110, other sensors, and/orother data sources. If the gateway 111 hosts an analytics engine, it mayprocess data and/or analysis results from the edge devices 101-110 toprovide classification and other services.

In one aspect, the analytics engine hosted by the gateway 111 mayclassify received radio signals as UAV control signals or a UAV videofeed by distinguishing those signals from other signals in theenvironment. The analytics engine might associate each classified signalwith a radio transmitter based on detected radio signal characteristicsfrom which target location and/or movement can be computed, and suchcharacteristics may be used to remove other signals from analysis. Theanalytics engine might employ other data sources, such as radar data,camera images, acoustic signatures, and the like to help associate eachclassified signal with its radio transmitter and distinguish signals ofinterest from signals that are not of interest. The analytics enginemight identify either or both UAV type and radio transmitter type basedon data and/or analysis results from the edge devices 101-110.Furthermore, the analytics engine might identify the presence of apayload on the UAV and may possibly identify weight, size, and/orcontents of the payload, such as via analysis of UAV flight behaviorand/or remote-sensing imaging data (e.g., radar cross-section, thermalsensing, camera images, etc.). The analytics engine might employexternal data sources, such as manufacturer-supplied data for the UAVand/or radio to aid in classifications described herein. The analyticsengine may classify a UAV as a threat based on any combination of flightbehavior, radio behavior, UAV payload features, and the like. In someaspects, the analytics engine can identify which UAV in a swarm is amaster or control device based on analysis of flight behavior,communication behavior, responsiveness to electronic countermeasures,and/or external data. The analytics engine may determine acountermeasure to be deployed against the threat based on a combinationof classification and heuristics. For example, UAV classification andradio classification might be used to select a correspondingcountermeasure. In some aspects disclosed herein, at least some of theaforementioned gateway 111 analytics are performed by ad-hoc clusters ofedge devices 101-110.

Although wireless networks and wired networks are described, any type ofnetwork may be used to couple the edge devices 101-110 to each other orto the gateway 111. A network or assembled group of edge devices 101-110may have both wired and wireless connections, and may use bothsimultaneously between nodes, peers, and gateway devices. Further thenetwork or assembled group of devices may use wired networks, wirelessnetworks, or both, to communicate with the cloud, and any higherperformance computing devices that may be participating to deliverservices or support the aspects disclosed herein. Each of these edgedevices 101-110 may be in communication with other edge devices 101-110,with data centers, including cloud servers 204, or combinations thereof.

In one aspect, an analytics engine may be hosted by the gateway 111 toprovide classification and prediction services for a counter unmannedaerial system (CUAS). As UAVs operate within a detection zone, theanalytics engine may predict, based on speed and heading, how long atarget UAV will take to reach the perimeter of a protected zone. Basedon classification of the UAV and its radio system, associated electroniccountermeasures may be selected, and the predicted success of thosecountermeasures along with predicted time to enact those countermeasuresmay then be used to select particular countermeasures to be enactedagainst the UAV. Electronic countermeasures may be performed by specificones of the edge devices 101-110 based on proximity to the UAV and/orits controller.

In some aspects, provided there is sufficient time to develop furtheranalyses, the analytics engine in the gateway 111 may send the data toan analytics engine hosted by a cloud server 204. The cloud server 204may then perform the classification in the analytics engine it hosts,and return the classification to the gateway 111. The gateway 111 maythen pass the classification or instructions based on the classificationto the edge devices 101-110 for performing additional detection and/orenacting countermeasures. Furthermore, the gateway 111 may access thedata associated with the UAV to train the gateway's 212 analyticsengine. This training may similarly be performed at analytics engineshosted on the edge devices 101-110.

The analytics engine hosted by the cloud server 204 may be used toproactively train an analytics engine hosted by the edge devices 101-110to increase the prediction accuracies. This allows the implementation ofa more economical client or edge hosted machine learning analyticsengine that has increasing prediction accuracies and near real-timeactionable items feedback. For the CUAS, improved prediction accuraciescan reduce the time to identify and mitigate a threat.

The techniques provide a method to enable an analytics engine hosted bycloud server to train a less powerful analytics engine hosted by an edgedevice. As described herein, the performance or prediction accuracy, ofthe analytics engine hosted by the edge device may progressively improveand converge towards the classification accuracy of the analytics enginehosted by the cloud server. Thus, over time, more classifications may bemade by edge devices 101-110 than the cloud analytics engine.

Further, the training process can be employed in an ad-hoc peer-to-peerconfiguration (or other local network configurations) across clusters ofedge devices 101-110 and between clusters. This enables scaling of thetraining across analytics engines hosted by edge servers. For example,one edge-hosted analytics engine may train any number of otheredge-hosted analytics engines, and this training may be performed viashort-range local area communications to avoid loading the backhaulnetwork. The techniques are applicable for training any analytics enginehosted by an edge server irrespective of how the analytics algorithm isimplemented. A machine learning algorithm may subsequently be used withdata and classifications received from an analytics engine hosted on thegateway and/or cloud server to optimize edge-hosted analyticsperformance.

It should be appreciated that a large number of edge devices 101-110 maybe communicatively coupled via the cloud 120. This may allow differentedge devices 101-110 to request or provide information to other devicesautonomously. In some aspects, multiple edge devices 101-110 may jointlyperform analytics wherein each device performs a different one of aplurality of analytics processes. Multiple devices may jointly decide onthe distribution of analytics tasks amongst themselves, each device mayselect an analytics task to perform independent of the other devices, orsome combination thereof may be implemented by edge devices 101-110cooperatively processing information. In accordance with some aspects,edge devices 101-110 may select analytics processes it performs based onlocal channel conditions of the radio signals it is processing, thelocal channel conditions comprising at least one of received signalpower, signal-to-noise measurements, channel state information, biterror rate, packet error rate, and the like.

Clusters of edge devices 101-110 may be equipped to communicate with thecloud 120. This may allow the edge devices 101-110 to form a cluster ofdevices, allowing them to function as a single device, which may betermed a fog device. Edge devices 101-110 may form clusters by queryingamongst themselves to determine which devices are receiving particularradio signals, and selection of the cluster may be based on the signalquality of radio signals of interest received by the devices. In someaspects, geographically distributed edge devices 101-110 may be selectedto provide the cluster with improved geolocating and ranging of a targetUAV. Edge devices 101-110 may be added to and removed from a cluster asa target UAV moves, such as to provide for improved tracking andobservation of the target.

FIG. 2 is a block diagram of a machine-learning system implemented inaccordance with aspects disclosed herein. The system can be implementedto incorporate a variety of processes, including semantic analysis 202,weighted decision-making 204, collaborative filtering 206, tacticalreasoning 208, machine language processing 210, summarization 212,temporal/spatial reasoning 214, and entity resolution 216 to generatecognitive insights.

Semantic analysis 202 broadly refers to performing various analysisoperations to achieve a semantic level of understanding about languageby relating syntactic structures. In aspects disclosed herein, languagepertains to communications between a radio controller and a UAV. Suchcommunications can be embodied in radio control and management signaling(including synchronization, acquisition, handshaking, sessionmanagement, resource management, error detection/correction, referencesignaling, and other radio control-plane signaling), and user-planesignaling (such as data payloads, application-layer control andmanagement, and UAV-control signaling). In certain aspects, varioussyntactic structures are related from the levels of phrases, clauses,sentences, paragraphs, and the conversation formats between the clientand server (e.g., UAV and controller), to the level of the body ofcontent as a whole. In aspects disclosed herein, “words” of a radiotransmission can comprise data sequences, and various data patterns canconstitute various words. Phrases, clauses, sentences, paragraphs, andconversations can be interpreted as sequences and patterns of suchwords. Conversation formats, including the expected format of responses,salutations, acknowledgements, authentication messages, heartbeatsignaling, any of various types of queries, session managementsignaling, resource grants, hashes, etc., are included as syntacticstructures. Also, other conversation characteristics, such as frequencyand timing of queries and responses, as well as the coding andmodulation of specific types of phrases in a conversation, are regardedas syntactic structures herein.

In various aspects, the semantic analysis 202 includes processing anintercepted radio signal to parse it into its individual parts, tagsentence elements that are related to predetermined items of interest(e.g., UAV communications), identify dependencies between individualwords or other signal patterns, and perform co-reference resolution. Insome aspects, data patterns in the radio transmission enable edgedevices 101-110 to detect the presence of such patterns without havingto demodulate the radio signal. For example, Fourier analysis canidentify repeated signal patterns. In some aspects, known data patternsin the radio signal can be exploited by the receiver to decrypt orotherwise decode intercepted signals. For example, some versions of theLightbridge radio protocol comprises long sequences of data symbols fromwhich the “encryption” code can be deciphered. Known data sequences(e.g., words) employed in preambles, headers, acknowledgements, and thelike can be detected to identify the type of communications withoutrequiring demodulation of the signal, and/or can be employed tofacilitate demodulation.

By way of example, UAV control signals can comprise signal structurethat differentiates them from other signal types. For example, a controlsignal can typically have smaller bandwidth and possibly a periodictransmission characteristic, as well as other characteristics, that canbe used by an analytics engine to differentiate it from mediatransmissions. The semantic analysis 202 can exploit known signalingcharacteristics, such as field length, known transmission sequences usedfor establishing and/or maintaining a link, formats for known responsesfor control-plane signaling, and various other known signaling formats.

A preamble is a signal used in network communications to synchronizetransmission timing between two or more systems. In general, preamble isa synonym for “introduction.” The role of the preamble is to define aspecific series of transmission criteria that is understood to mean“someone is about to transmit data.” Preambles typically employ alow-complexity modulation format, such as bpsk, and its constant-modulusproperty can be used to distinguish the preamble from other parts of atransmission.

At the network layer, a packet header contains control information, suchas addressing, and is located at the beginning of the PDU. A trailercontains control information added to the end of the PDU. Known fieldlengths in the header and/or trailer, as well as expected field valuescan be used to identify a particular communication signal, communicationtype, or at least separate the signal from other signals.

Semantics analysis can employ a logical ruleset engine that developsand/or stores the logical rules (e.g., grammar rules or grammar shapes)which can be used to detect and identify communication from interceptedradio signals. Grammar can be defined as the whole system and structureof a language or of languages in general, usually taken as consisting ofsyntax and morphology (including inflections) and sometimes alsophonology and semantics. Syntax is the arrangement of words and phrasesto create well-formed sentences in a language. The concept ofwell-formed sentences, as used herein, can comprise signaling format,such as defined by a radio network communications standard. Grammar canalso comprise the principles or rules of a technique, such as a remotecontrol technique for guiding a UAV, the technique being reflected inthe data format (e.g., words) of the data transmission, and possiblyproviding physical characteristics of the transmitted signal, which canbe measured and processed without demodulating the signal in order toidentify the type of data being transmitted. Phonology is ordinarilydefined as the system of relationships among the speech sounds thatconstitute the fundamental components of language. In aspects disclosedherein, phonology can comprise relationships between data bits, datasymbols, and data words that constitute fundamental components of acommunication protocol.

Semantics comprises a number of branches and subbranches of semantics,including formal semantics, which studies the logical aspects ofmeaning, such as sense, reference, implication, and logical form;lexical semantics, which studies word meanings and word relations; andconceptual semantics, which studies the cognitive structure of meaning.As used herein, similar data-word structures may be used to conveydifferent information depending on the context in which the words areused. For example, control signaling features for controlling a UAV maycomprise similar data words used to provide network management andcontrol of the radio communications. However, whereas network managementand control features occupy known control-signaling locations in a radioor network signal, UAV control signaling features are likely to residein the data payload of a packet and/or frame. Besides location, thefrequency of such words and proximity to other words (and/or signalfeatures) can differentiate between similar words used for differentpurposes.

Weighted decision-making 204 broadly refers to performing multi-criteriadecision making operations to achieve a given goal or target objective.In various aspects, one or more weighted decision-making 204 processesare implemented by the system to define predetermined goals, which inturn contribute to the generation of a cognitive insight. For example,goals for protecting an asset include minimizing the use of kineticcountermeasures, minimizing interference with other radio systems,minimizing collateral damage, ensuring that white-listed UAVs are notharmed, and keeping threats outside a predetermined perimeter. In thisexample, it will be appreciated that certain goals may be in conflictwith another. As a result, a cognitive insight may indicate a kineticcountermeasure be enacted against a fast-moving UAV while it is in anouter zone. While this may result in collateral damage, it may provide abetter outcome given that non-kinetic countermeasures may not beeffective in protecting the asset. If the UAV is controlled by a WiFi orLTE signal, a cognitive insight might indicate that interrupting otherradio systems by transmitting a jamming signal might be acceptable giventhe prospect of collateral damage due to enacting kineticcountermeasures.

Collaborative filtering 206, as used herein, broadly refers to theprocess of filtering for information or patterns through thecollaborative involvement of multiple agents, sensors, data sources, andso forth. The application collaborative filtering 206 processes caninvolve very large and diverse data sets in addition to remote-sensingdata, including (but not limited to) UAV device technical data, radiotransceiver technical data, weather, newsfeeds, public forums, socialmedia and other forms of Internet chatter. Collaborative filtering 206also refers to the process of making automatic predictions by collectinginformation from many devices, sensors, and/or external data sources.For example, if a terrorist attack is reported against other assets, thesystem may employ an escalated alert state that reduces a threshold fordetermining that a UAV is a threat.

Tactical reasoning 208 broadly refers to simulating the human ability tomake deductions from common facts they inherently know. Such deductionsmay be made from inherent knowledge about the physical properties,purpose, intentions, and possible behavior of a UAV, such as based onits flight, its payload, location, the location of its controller,and/or the radio protocol employed to control it. In various aspectspertaining to analyzing radio communications, tactical reasoning 208processes are implemented to assist the system in understanding anddisambiguating words within a predetermined context. It will beappreciated that if the context of a word is better understood, then acommon sense understanding of the word can then be used to assist inevaluating intent of the UAV. In various aspects, this better or moreaccurate understanding of the context of a word, and its relatedinformation, allows the system to make more accurate deductions aboutthe radio protocol, which are in turn used to generate cognitiveinsights for generating a protocol manipulation or other electroniccountermeasure.

Machine language processing (MLP) 210 broadly refers to interactionswith a system through the use of data communication standards, includingnetwork standards (e.g., radio communication standards) and UAV-controlstandards. In various aspects, MLP 210 processes are implemented toachieve language understanding (for either or both the radio protocoland the UAV-control protocol), which enables it to not only derivemeaning from intercepted signals, but to also generate electroniccountermeasures, such as to hijack the UAV or otherwise control the UAV.Summarization 212, as used herein, broadly refers to processing a set ofinformation, organizing and ranking it, and then generating acorresponding summary. As an example, sensor data for a set of UAVs canbe processed to identify their likely purpose, potential threat, andassociated observations, which are then ranked and presented to agraphical user interface (GUI). In certain aspects, varioussummarization 212 processes are implemented to generate cognitiveinsights.

Temporal/spatial reasoning 214 broadly refers to reasoning based uponqualitative abstractions of temporal and spatial aspects of tacticalknowledge. For example, it is common for a predetermined set of data tochange over time. Likewise, other attributes, such as its associatedmetadata, may likewise change over time. As a result, these changes mayaffect the context of the data. By way of example, the context of a UAVoperating late at night may be quite different than a UAV operating inthe same manner during normal business hours.

Entity resolution 216 broadly refers to the process of finding elementsin a set of data that refer to the same entity across different datasources. In various aspects, the entity resolution 216 process isimplemented to associate certain received data with specific UAVs. Forexample, radio transmission meta data (e.g., frequency shift, phaseoffset, delay, angle of arrival, signal strength, change in frequencyshift, change in phase offset, change in delay, change in angle ofarrival, change in signal strength) may be processed with other sensordata (e.g., radar, lidar, optical images, acoustic signatures, etc.) toassociate radio signals with specific UAVs and/or controllers.

It will be appreciated that the implementation of one or more of thesemantic analysis 202, weighted decision-making 204, collaborativefiltering 206, tactical reasoning 208, machine language processing 210,summarization 212, temporal/spatial reasoning 214, and entity resolution216 processes by the system can facilitate the generation of a semantic,cognitive model.

In certain aspects, the system receives ambient data 220, curated data222, and learned knowledge 224, which is then processed to generate oneor more cognitive graphs 228. In turn, the one or more cognitive graphs228 are further used by the system to generate cognitive insightstreams, which are then delivered to one or more destinations 230. Asused herein, ambient signals 220 broadly refer to input signals, orother data streams, that may contain data providing additional insightor context to the curated data 222, and learned knowledge 224. Forexample, ambient data may allow the system to understand that a UAV iscurrently being controlled by a user at a specific geographical locationwithin a detection perimeter, the UAV is registered to a particularcompany authorized to perform package delivery services, and theparticular UAV model is designed to carry a payload up to 10 lbs. Tocontinue the example, there is a difference between the UAV beingoperated during normal business hours along an expected flight path andbeing operated after business hours and flying low to evade detection.

In various aspects, the curated data 222 may include structured,semi-structured, unstructured, public, private, streaming, device orother types of data. In various aspects, the learned knowledge 224 isbased upon past observations and feedback from the presentation of priorcognitive insight streams and decisions. In certain aspects, the learnedknowledge 224 is provided via a feedback loop that provides the learnedknowledge 224 in the form of a learning stream of data. By way ofexample, the responsiveness of UAVs to selected ECMs can be used toupdate ECM classifications indexed by UAV and/or communication types.

A cognitive graph 228 refers to a representation of expert knowledgeassociated with UAVs and communication devices/protocols over a periodof time, to depict relationships between radio signals, places, times,device uses, and behavior patterns. As such, it is a machine-readableformalism for knowledge representation that provides a common frameworkallowing data and knowledge to be shared and reused across devices,applications, and networks. In various aspects, the informationcontained in, and referenced by, a cognitive graph 228 is derived frommany sources, such as curated data 222. In some aspects, the cognitivegraph 228 assists in the identification and organization of informationassociated with how detected communication signals ultimately relate tosecurity threats. In various aspects, the cognitive graph 228 enablesautomated agents to access the sensor data, as well as remote datasources, more intelligently, and enumerate inferences throughutilization of curated, structured data 222.

In certain aspects, the cognitive graph 228 not only elicits and mapsexpert knowledge by deriving associations from data, it also rendershigher-level insights and accounts for knowledge creation throughcollaborative knowledge modeling. In various aspects, the cognitivegraph 228 is a machine-readable, declarative memory system that storesand learns both episodic memory (e.g., specific experiences associatedwith an individual UAV, UAV type, and/or radio protocol), and semanticmemory, which stores factual information (e.g., UAV and transceivertechnical specifications, operating system technical specifications,application software technical specifications, communication protocoltechnical specifications, etc.). For example, the cognitive graph 228may indicate that a particular model of UAV has a high-capacity payload,and that such UAVs normally employ a specific radio communicationprotocol. Furthermore, the cognitive graph 228 may know that terroristsmost often used that model of UAV to conduct attacks.

In certain aspects, a cognitive insight stream is bidirectional andsupports flows of information both to and from destinations 230. Forexample, the first flow may be generated in response to identifying athreat, and target UAV information is then delivered to one or moredestinations 230. The second flow may be generated in response to howthe threat is dealt with, and the responsiveness of the target UAV toany countermeasures. This results in the provision of information to thesystem. In response, the system processes that information in thecontext of what it knows about the target UAV, and provides additionalinformation to the destination, such as an adaptation to thecountermeasure(s).

In some aspects, the cognitive insight stream may include a stream ofvisualized insights. As used herein, visualized insights broadly refersto cognitive insights that are presented in a visual manner, such as amap, an infographic, images, animations, and so forth. In variousaspects, these visualized insights may include certain cognitiveinsights, such as predicted course and time of arrival of the targetUAV, likelihood that the target UAV is a threat, deadlines to deploycountermeasures of various types. The cognitive insight stream isgenerated by various cognitive agents, which are applied to varioussources, datasets, and cognitive graphs. As used herein, a cognitiveagent broadly refers to a computer program that performs a task withminimum specific directions from users and learns from each interactionwith data.

In some aspects, the system delivers Cognition as a Service (CaaS). Assuch, it provides a cloud-based development and execution platform thatenables various cognitive applications and services to function moreintelligently. In certain aspects, cognitive applications powered by thethe system are able to think and interact with system users asintelligent virtual assistants. As a result, users are able to interactwith such cognitive applications by asking them questions and givingthem commands. In response, these cognitive applications can assist theuser in enhancing their situational awareness and developing actionableinformation regarding detected threats.

In these and other aspects, the system can operate as an analyticsplatform to provide data analytics through a public, private or hybridcloud environment. As used herein, cloud analytics broadly refers to aservice model wherein data sources, data models, processingapplications, computing power, analytic models, and sharing or storageof results are implemented within a cloud environment to perform one ormore aspects of analytics. In various aspects, users submit queries andcomputation requests in a natural language format to the system. Inresponse, they are provided with a ranked list of results and aggregatedinformation with useful links and pertinent visualizations through agraphical representation.

FIG. 3A is a flow diagram of a computer-implementable method performedby a UAV-detection network configured for generating a cognitiveinsight. A training step 301 comprises receiving training data basedupon sensor measurements of at least one UAV for processing in acognitive learning and inference system. A machine-learning operation302 comprises performing a plurality of machine learning operations onthe training data for generating a cognitive profile of the at least oneUAV. Cognitive insight generation 303 comprises generating a cognitiveinsight based upon the cognitive profile generated using the pluralityof machine learning operations. Based on the cognitive insight, one ormore countermeasures may be enacted 304 against the UAV.

The training data typically consists of a set of training examples, witheach example consisting of an input object (e.g., a vector) and adesired output value (e.g., a supervisory signal). In various aspects, asupervised learning algorithm is implemented to analyze the trainingdata and produce an inferred function, which can be used for mapping newexamples. As likewise used herein, an unsupervised learning machinelearning algorithm broadly refers to a machine learning approach forfinding non-obvious or hidden structures within a set of unlabeled data.In various aspects, the unsupervised learning machine learning algorithmis not given a set of training examples. Instead, it attempts tosummarize and explain key features of the data it processes.

With reference to FIG. 3B, disclosed techniques comprise detecting,identifying, and characterizing unknown signals via signal features andmeta features using machine learning. In some aspects, known signalstructure can be exploited to detect, identify, and characterize radiocontrol (downlink) signals and uplink (e.g., video, data, control)signals. Based on any combination of sensor data, learned knowledge, anda prior information about a UAV of interest, signal attributes foruplink and/or downlink signals are determined 311. In some cases, symbolstreams of these signals possess properties that can be used to detectand differentiate them from other signals in the environment. Steps 311and/or 312 can comprise the following aspects.

Some aspect can employ constant modulus algorithms (CMAs), which exploitthe constant modulus of symbol streams or portions thereof, such aspreambles, headers, reference signals, network management signals, etc.Since the CM envelope resists cochannel interference and noise, it istypically used for signal acquisition and synchronization. CM is alsoused for channel sounding (e.g., pilot tones and other trainingsequences) and reference signals.

In some aspects, frame-synchronous feature extraction (FSFE) algorithmsare employed, which exploit the structure of repeated signals. This canbe used to extract information from signals with repeated spreadingcodes, including regular frequency hopping sequences. Some aspectsemploy partially-blind algorithms, which can use geolocation and/orbaseband symbol data provided from external sources (e.g, radar (andother detection and ranging systems), GPS data (e.g., from the targetUAV and/or from nearby sensors), and external databases (e.g., radiostandards, UAV manufacturer's technical data (e.g., includingUAV-control data format, video data format, communication protocol, andthe like). Signals of interest can possesses internal fields that can beexploited to aid detection, identification and demodulation, such asrepeated user-data sequences, control-data sequences, andnetwork-management data.

In some aspects, a unique radio-frequency (RF) fingerprint from the UAVtransmitter can be measured, and this RF fingerprint can be used toseparate signals of interest from other signals and track the UAV. TheRF fingerprint can be detected and recorded in the time-domain based ontransient features of a signal's shape, and/or in the frequency-domainwhen known data values are transmitted, wherein the signal can bespectrally decomposed into one or more components that reveal a uniquespectral fingerprint.

In some aspects, detecting, identifying, and characterizing a UAV'stransmission can exploit known signal features (e.g., trainingsequences, pilot tones, reference signals, etc.) to estimate MIMOsignatures. Such MIMO signatures can be used to filter received signalsin order to differentiate signals from a UAV of interest from othersignals and remove co-channel interference. A MIMO signature can beregarded as a known signal feature from which other signal features maybe determined 311, and a MIMO signature can be regarded as meta datacomputed from other signal attributes 312. Such MIMO processing can beadvantageously performed in a distributed antenna system comprisingmultiple edge devices, and the processing may be implemented by anycombination of distributed and centralized processing.

Machine learning 302 comprises generating a cognitive profile. As usedherein, a cognitive profile refers to an instance of a cognitive personathat references device-specific data associated with a UAV.Device-specific data may include UAV manufacturer, UAV model, computeroperating system, operating system version, installed software, deviceidentifiers (e.g., MAC address, IP address, subscriber ID number, phonenumber, etc.), controller specifications (including hardware andsoftware specifications), UAV payload capacity, flight performancecapabilities, camera specifications, transceiver specifications,communication formats, etc. In certain aspects, the cognitive profilemay include data associated with a device's interaction with the CUAS,such as geolocation data from remote sensors (e.g., radar, lidar,acoustical sensors, optical sensors, cameras, GPS data), frequencyoffsets, time offsets, phase offsets, received signal power (and ratesof change of those measurements), and responsiveness of similar UAVs tocountermeasures, as well as other (possibly) related cognitive insights.In various aspects, the device data may be distributed. Thus, subsets ofthe distributed device data may be logically aggregated to generate oneor more cognitive profiles, each of which is associated with the UAV. Invarious aspects, the UAV's interaction with a CUAS may be provided asfeedback data.

In some aspects, the cognitive profile comprises metadata of a receivedsignal. The metadata can include:

-   -   a) the position, transmit power, frequency, phase, and delay for        any target transmitter (e.g., UAV);    -   b) the position, orientation, phase, and delay of the        receiver(s) (e.g., edge devices); and    -   c) the received signal's time offset, received incident power,        line of bearing, direction of arrival, frequency, carrier phase,        and deltas of any of the aforementioned signal features.

To generate a cognitive profile for a UAV of interest, meta data can beused to associate particular received signals (and thus, signal and/orcommunication features) with the UAV of interest 313.

For example, when multiple spatially separated or geographicallyseparated radio receivers (e.g., edge devices) are employed forreceiving radio transmissions from either or both the UAV and itscontroller, differences in signal timing offset, frequency shift, phase,and power of the received transmission from the different radioreceivers can constitute a spatial signature associated with thelocation of the transmitter. The spatial signature may be compared withradar data and/or other remote-sensing data, such as to assist inassociating transmissions with a particular target 313. This signaturecan be used to discriminate between signals of interest and othersignals. Furthermore, a clock reference and location data for each ofthe receivers can be used to geolocate the transmitter. Any movement ofthe transmitter can produce uniquely identifying variations in thesignal timing offset, frequency shift, phase, and/or power of thereceived transmission, and such variations can be used to furtherdistinguish signals of interest from other signals (e.g., signals not ofinterest). Such variations can be processed to compute the UAV'smovement, including changes in altitude and course. Thus, it can beadvantageous to employ a widely distributed network of radio receivers(e.g., edge devices). Aspects disclosed herein can be used to identifyradio sources that are not of interest in order to remove correspondingsignals from the received signals. For example, successive interferencecancellation or any advanced receiver structure may be employed toreduce the effect of such co-channel interference.

Further to the process of machine learning 302, only those receivedsignals with metadata corresponding to a UAV of interest (or at leasthaving metadata that does not disqualify signals from being transmittedby the UAV of interest) need to be further processed (e.g., step 314) toexamine the content and structure of the communications (e.g., enableprotocol penetration) and/or develop electronic countermeasures. Thiseffects intelligent discrimination through physically corroborative (ornegating) evidentiary observation of properties necessarily associatedwith the signal (metadata) that are unrelated to its information content(message). The information contained in the transmission may beextracted to further develop the cognitive profile, and may be usedsubsequently to formulate electronic countermeasures against the UAV.

With respect to step 314, it can be useful to classify the receivedsignals with respect to radio protocol classification, such as to effectdeeper protocol penetration and/or select associated countermeasures. Insome aspects, when a received signal does not match a known radioprotocol classification, generalized signal classifications can be used.Such generalized signal classifications might include CDMA, OFDM,SC-FDMA (e.g., CI-OFDM), DSSS, FHSS, and so on. Protocol penetrationand/or electronic countermeasure development can be implemented based onthe generalized signal classification.

Machine learning classifiers employed in step 314 can be trained toclassify signal features (and/or communication behavior, such asconversations) through a supervised learning technique that providesexposure to examples that have already been correctly classified andlabeled. Such classifiers can categorize signals not related to a UAV ofinterest to help classify signal features and communication protocols,and generally help to handle and organize an ever-increasing number ofcommunication protocols and signaling formats. Examples of suchclassifiers include the Naive Bayes classifier, linear regression,polynomial regression, and neural networks. These types of classifierscan include different modes of operation such as a training mode and aclassifying/querying mode. When operating in a training mode, aclassifier reads sensor data examples with categories from a set oftraining data that have already been correctly classified and labeled,and it saves the training results. When operating in aclassifying/querying mode, a classifier receives a query (i.e., querysensor data input to be classified), and leverages the training resultspreviously obtained to calculate a best-match category with which tomatch the query.

In aspects disclosed herein, machine learning algorithms can beimplemented with a cognitive learning technique. A supervised learningmachine learning algorithm may be implemented with a direct correlationscognitive learning technique. An unsupervised learning machine learningalgorithm may be implemented with a patterns and concepts cognitivelearning technique, a behavior cognitive learning technique, or both. Aprobabilistic reasoning machine learning algorithm may be implementedwith a concept entailment cognitive learning technique, a contextualrecommendation cognitive learning technique, or both.

As used herein, a supervised learning machine learning algorithm broadlyrefers to a machine learning approach for inferring a function fromlabeled training data. The training data typically consists of a set oftraining examples, with each example consisting of an input object(e.g., a vector) and a desired output value (e.g., a supervisorysignal). In various embodiments, a supervised learning algorithm isimplemented to analyze the training data and produce an inferredfunction, which can be used for mapping new examples. An unsupervisedlearning machine learning algorithm broadly refers to a machine learningapproach for finding non-obvious or hidden structures within a set ofunlabeled data. In various aspects, the unsupervised learning machinelearning algorithm is not given a set of training examples. Instead, itattempts to summarize and explain key features of the data it processes.

Examples of unsupervised learning approaches include clustering (e.g.,k-means, mixture models, hierarchical clustering, etc.) and latentvariable models (e.g., expectation-maximization algorithms, method ofmoments, blind signal separation techniques, etc.). A probabilisticreasoning machine learning algorithm broadly refers to a machinelearning approach that combines the ability of probability theory tohandle uncertainty with the ability of deductive logic to exploitstructure. More specifically, probabilistic reasoning attempts to find anatural extension of traditional logic truth tables. The results theydefine are derived through probabilistic expressions instead.

In some aspects, reinforcement learning approaches can be implemented incombination with a patterns and concepts, a behavior, a conceptentailment, or a contextualization recommendation cognitive learningtechnique when performing cognitive learning operations. As used herein,reinforcement learning broadly refers to machine learning approaches inwhich software agents take actions within an environment to maximize anotion of cumulative reward. Such reinforcement approaches are commonlyused in game theory, control theory, operations research, informationtheory, simulation-based optimization, multi-agent systems, swarmintelligence, statistics, and genetic algorithms.

In certain embodiments, a particular cognitive learning technique mayinclude certain aspects of a secondary cognitive learning style, aspectsof a secondary learning category, or a combination thereof. As anexample, the patterns and concepts cognitive learning technique mayinclude implementation of certain aspects of the direct correlations andconcept entailment cognitive learning techniques, and by extension,implementation of certain aspects of the declared and inferred cognitivelearning styles. In various aspects, the data-based cognitive learningcategory, machine learning algorithms, and the interaction-basedcognitive learning category are respectively associated with the source,process and deliver steps of a cognitive learning process.

As used herein, a cognitive learning process broadly refers to a seriesof cognitive learning steps that produce a cognitive learning result.With respect to FIG. 4A, a source step 401 of a cognitive learningprocess broadly refers to operations associated with the acquisition ofdata used to perform a cognitive learning operation. Likewise, as usedherein, a process step 402 of a cognitive learning process broadlyrefers to the use of individual machine learning algorithms to performcognitive learning operations. As likewise used herein, a deliver step403 of a cognitive learning process broadly refers to the delivery of acognitive insight, which results in an interaction. Information relatedto, or resulting from, the interaction is then used by the CUAS toperform cognitive learning operations 404.

Step 404 can comprise provisioning the cognitive insights in a CUASreceiving feedback information related to a particular UAV. In oneaspect, the feedback information is used to revise or modify aparticular cognitive persona of the UAV. In another embodiment, thefeedback information is used to revise or modify a cognitive profileassociated with the UAV. In yet another aspect, the feedback informationis used to create a new cognitive profile, which can be stored in acognitive profiles repository. In still yet another aspect, the feedbackinformation is used to create one or more associated cognitive profilesthat inherit a common set of attributes from a source cognitive profile.In another aspect, the feedback information is used to create a newcognitive profile that combines attributes from two or more sourcecognitive profiles.

While cognitive personas and cognitive profiles are described hereinwith reference to UAVs, it should be appreciated that cognitive personasand/or cognitive profiles may be developed and adapted for particularradio communication systems, devices, and protocols. To be clear, thedescriptions herein that reference UAVs can be made in reference toradio transceivers in general, and such disclosures herein are notlimited to UAVs. In various aspects, the cognitive insight is deliveredto a device, an application, a service, a process, a user, or acombination thereof. In some aspects, the resulting interactioninformation is likewise received by a CUAS from a device, anapplication, a service, a process, a user, or a combination thereof. Insome aspects, the resulting interaction information is provided in theform of feedback data to the CUAS.

FIG. 4B illustrates a classification method that can be performed inaccordance with certain aspects of the disclosure. A received signal ischannelized or broken down into data fragments 411, which can then beprocessed independently and in parallel 412. Different classificationalgorithms may be performed in 412, and the results combined 413 in asubsequent decision step to produce a classification result. Based on acombination of the classification result and feedback, confidenceweights (e.g., soft-decision weights) for each of classificationalgorithms may be updated 414.

A variety of different channelization methods can be implemented in 411,including time-domain channelization, frequency-domain channelizationmethods, or mixed time-frequency channelizations, such as wavelet-basedchannelizers. The channelizer downconverts, digitizes, and channelizesthe received signals. An exemplary channelizer uses Fast-FourierTransform (FFT) operations. For example, the channelizer may first applya zero-padded FFT and a rectangular window to each block of datasymbols. The channelizer then selects a number of output bins for use insubsequent adaptive processing and machine learning algorithms. In oneaspect, the output channelizer bins may be preselected (e.g., to reducecomplexity of the channelization operation, such as via sparse FFTmethods). In other aspects, the output channelizer bins are adaptivelyselected, possibly based on feedback information.

With respect to 412, different data fragments may be processed inparallel using different algorithms. In some aspects, the same fragmentof a signal of interest may be processed using different algorithms,such as when the same signal fragment is received by differentreceivers. Each receiver may employ a predetermined algorithm, or eachreceiver may select an algorithm depending on some quality metric, suchas received signal strength, detected interference, SNR, channel stateinformation, as well as other metrics. Different receiver types (such asmay be indicated by the number of spatial degrees of freedom) maydetermine which algorithms are employed. Different algorithms anddifferent machine learning approaches, such as a random forest and adeep learning network, may run in parallel for analyzing the samefeatures. The algorithms can run in parallel to feed decisions points,which may trigger an additional parallel cascade of algorithms. Eachalgorithm can be dynamically weighted based on various rules that can beinjected at run time.

FIG. 5 is a flow diagram according to one aspect of the disclosure.Aspects disclosed herein, such as in FIG. 5 and the other figures, canbe implemented as apparatus configurations comprising structuralfeatures that perform the functions, algorithms, and methods describedherein. Flow charts and descriptions disclosed herein can embodyinstructions, such as in software residing on a non-transitorycomputer-readable medium, configured to operate a processor (or multipleprocessors). Flow charts and functional descriptions, includingapparatus diagrams, can embody methods for operating a communicationnetwork(s), coordinating operations which support communications in anetwork(s), operating network components (such as client devices,server-side devices, relays, and/or supporting devices), and assemblingcomponents of an apparatus configured to perform the functions disclosedherein.

A radio receiver 501 comprises one or more radio receivers at one ormore edge devices that provide radio sensing data inputs to thecognitive inference and machine learning system. A spectrum fragmenter502 partitions IQ data received from the radio receiver 501 intoindependent groups, referred to herein as pulses. The spectrumfragmenter 502 preprocesses the pulses for cleaning, followed bycompression for use in downstream processes. Pulse events capturecompressed representations of enhanced signals, timestamps correspondingto the beginning and end points of signal chunks, and a scalable amountof metadata, for example. Pulse events are consumed by downstreamsystems to add more metadata, manage the data flow, and/or generateintelligent responses (e.g., alerts, mitigations, etc.) based on theinformation within the pulse event. The fragmentation and compressionhelps reduce loads on a network coupling the edge devices to a centralprocessor's analytics engine.

The spectrum fragmenter 502 in accordance with one aspect is able tomonitor large parts of a spectrum and perform signal triage. Thisprovides the ability to rapidly detect, classify, and prioritizedetected radio signals based on high-level, context-dependent userdirectives. Unlike existing technologies that scan the RF spectrum withmatched filters searching for specific signature types, featureextraction can be employed in combination with machine learning togeneralize discovery of signals as well as dynamically reconfigurereceivers to search for specific signal characteristics. Using aconfigurable feature extraction and a machine learning pipeline, thedisclosed system can observe a patchwork of RF spectrum apertures andconcurrently detect, learn, and identify distinct signal types fromamong an extensible set of configurations for domain-specificmanagement.

A throughput manager 503 partitions computational work loads across ahybrid architecture. Upon processing completion, it reassembles theparallelized work into context-specific data and corresponding metadatafor use within at least one analytic engine 504. Metadata that isprovided can be used for data-driven routing that enables high-leveluser directives to be interpreted as specific endpoints. For example,the ability to flag high-throughput observations directly to datapersistence enables off-line training.

The analytic engine 504 maintains context-specific processing pipelinesthat generate real-time actionable knowledge. For example, the analyticengine 504 allows multiple machine-learning algorithms to be stacked andnetworked. This enables supervised and unsupervised approaches tocollaborate and infer robust classifications from input data andmetadata.

The analytic engine 504 can manage machine learning algorithms toclassify collections of observations. Data passes through the analyticengine 504 either as streaming pulse events received in real time orreplays of saved data from a data-persistence storage medium. Whenrunning in its classification mode, real-time observations arriving aspulse events may be passed through a collection of stacked machinelearning algorithms to create per-pulse predictions. In some aspects,analytics running concurrently can veto predictions made by othermachine learning models. Pulses that are flagged as unknowns may berouted to a data persistence module so they can be cached for off-linetraining.

When the analytic engine 504 is running in off-line mod, pulse eventscached by the system can undergo analysis to tease apart classificationmodels to segregate different unknown types. Different unknown types canbe managed by the analytic engine 504 using hashed representations oftheir feature metadata. These hashes in turn can be used to createanswer keys for automated supervised learning and can enable automatedgeneration in comparison of confusion matrices.

The analytic engine 504 can utilize the throughput manager 503 todistribute computational loads across the hybrid architecture. Thesystem can be configured to run such that the off-line training and thereal time classifications can be scheduled across available hardwareresources.

Information obtained from streaming pre-cleaned pulses that have beenpassed over data-driven pathways can be flagged for persistence.Persistence can take a variety of forms, such as storing pre-cleanedpulses output from the spectrum fragmenter 502 using high-fidelitycompression. Later, sparse transforms can enable reconstitution in aquality that can be demodulated. Compressed pulses can be captured andplaced into caches. Any of various types of storage media can beemployed. Caches may be used to enable off-line training to identifycorrelations and improve classification of new unknown signals.

Data processed by the analytic engine 504 can result in actionableknowledge, expressed as a pulse event, and collected in an actionableknowledge module 505, which can comprise a combination of processing andstorage capabilities. The pulse event can contain the compressed signal,feature metadata, and system classifications, with corresponding errorestimates. This information can be consumed by downstream processes viacustomized stream descriptors, such as topics. These context-dependentknowledge streams can be subscribed to and may result in near real-timeupdates. Downstream systems interpret the streams relative to theiroperating contexts.

A response dispatcher 506 can be configured for interpreting high-leveluser directives and applying them to carry out end-user goals. Forexample, the end user may specify a rule, such as a request to benotified about all low-flying drones that are approaching a protectedarea. After interpreting this rule, observed signals meeting thiscriterion are evaluated and triaged related to their risk. Signals withthe greatest risk are prioritized and may be responded to usingprioritized rule set directives such as 1) attempt to redirect usingknown mitigation strategies, 2) attempt smart jamming, 3) notifypersonnel and attempt another jamming strategy, and 4) if all elsefails, conduct a kinetic attack. It should be appreciated that userdirectives may include other criteria, such as, but not limited to,radio frequency, signal type (modulation, bandwidth, duty cycle, as wellas others), signal strength, protocol behavior, and signal identifiers(e.g., MAC ID, radio fingerprint, IP address, mobile subscriberidentifier, or the like).

The transmit component(s) 507 of the CUAS is responsible for queuingresponses that have been received from the response dispatcher 506. InFHSS aspects, for example, responses can be matched with the appropriatetiming and frequency position that corresponds to the target timingpatterns and the frequency hopping patterns that have been derived fromobservations or loaded from libraries.

UAV detection, identification, and countermeasure systems and methodshave been disclosed herein. The specific network resources to beemployed for each system function can be provisioned based on itslocation in the network, as well as its proximity to other networkresources. The network resources can be provisioned with respect to eachfunction's requirement(s), such as maximum tolerable latency, minimumdata bandwidth, as well as others. For example, latency-sensitiveoperations can be performed close to the network edge. Operationsrequiring a large amount of processing and/or storage resources might bepooled in a central location, such as a data center farther from theedge, or widely distributed across multiple data centers, for example.

The various blocks shown in the figures can be viewed as method steps,and/or as operations that result from operation of computer programcode, and/or as a plurality of coupled logic circuit elementsconstructed to carry out the associated function(s).

In general, the various exemplary aspects may be implemented in hardwareor special purpose circuits, software, logic or any combination thereof.For example, some aspects may be implemented in hardware, while otheraspects may be implemented in firmware or software which may be executedby a controller, microprocessor or other computing device, although theinvention is not limited thereto, While various aspects of the exemplaryembodiments of this invention may be illustrated and described as blockdiagrams, flow charts, or using some other pictorial representation, itis well understood that these blocks, apparatus, systems, techniques ormethods described herein may be implemented in, as non-limitingexamples, hardware, software, firmware, special purpose circuits orlogic, general purpose hardware or controller or other computingdevices, or some combination thereof.

It should thus be appreciated that at least some aspects of theexemplary aspects of the invention may be practiced in variouscomponents, such as integrated circuit chips and modules, and that theexemplary aspects may be realized in an apparatus that is embodied as anintegrated circuit. The integrated circuit, or circuits, may comprisecircuitry (as well as possibly firmware) for embodying at least one ormore of a data processor or data processors, a digital signal processoror processors, baseband circuitry, and radio frequency circuitry thatare configurable so as to operate in accordance with the exemplaryaspects.

While aspects of the disclosure are directed toward UAVs, such aspectsembodied in the systems and methods disclosed herein can be applied toother radio remote-controlled systems and devices, including, but notlimited to unmanned nautical vehicles, unmanned terrestrial devices,sensor networks, home automation systems, supervisory control and dataacquisition systems, and all types of robotic devices.

1. A method, comprising: provisioning a computer processor to employnetwork communication signal metadata for training a cognitive learningand inference system to produce an inferred function, wherein themetadata comprises a syntactic structure of at least one networkcommunication protocol; provisioning the computer processor to employthe inferred function for mapping metadata of a detected networkcommunication signal to a cognitive profile of a transmitter of thedetected network communication signal, wherein the mapping effectsintelligent discrimination of the transmitter from at least one othertransmitter through corroborative or negating evidentiary observation ofproperties associated with the metadata of the detected networkcommunication signal; and provisioning the computer processor to employthe inferred function or the cognitive profile to determine informationcontent in the network communication signal without demodulating thenetwork communication signal.
 2. The method recited in claim 1, whereinthe training comprises performing at least one of supervised learningand unsupervised learning.
 3. The method recited in claim 1, wherein thesyntactic structure comprises a structure of at least one of phrases,clauses, sentences, paragraphs, and conversation formats of the at leastone network communication protocol; and at least one of the training andthe mapping comprises performing semantic analysis of the metadata. 4.The method recited in claim 1, wherein the mapping comprises employingat least one of grammar rules and grammar shapes corresponding to the atleast one network communication protocol to identify a type of data inthe detected network communication signal.
 5. The method recited inclaim 1, further comprising provisioning the computer processor todetermine a response to the transmitter based upon the mapping
 6. Themethod recited in claim 1, wherein the mapping employs at least one of ameasured radar cross section; a camera image; an acoustical signature;an infrared signature; an optical signature; navigation data; videodata; network management data; and a radio signal measurement comprisingat least one of frequency shift, phase offset, delay, angle of arrival,signal strength, change in frequency shift, change in phase offset,change in delay, change in angle of arrival, change in signal strength.7. The method recited in claim 1, further comprising provisioning thecomputer processor to associate received network communication signalswith the transmitter by comparing the metadata of the detected networkcommunication signal with location information of at least one of thetransmitter and the transmitter's intended receiver.
 8. A networktransceiver comprising at least one processor, memory in electroniccommunication with the at least one processor, and instructions storedin the memory, the instructions executable by the at least one processorfor: employing network signal metadata to train a cognitive learning andinference system to produce an inferred function, wherein the metadatacomprises a syntactic structure of at least one network communicationprotocol; employing the inferred function for mapping metadata of adetected network signal to a cognitive profile of a transmitter of thedetected network signal, wherein the mapping effects intelligentdiscrimination of the transmitter from at least one other transmitterthrough corroborative or negating evidentiary observation of propertiesassociated with the metadata of the detected network signal; and basedon the inferred function or the cognitive profile, determininginformation content in the network signal without demodulating thenetwork signal.
 9. The network transceiver recited in claim 8, whereinemploying the network signal metadata to train the cognitive learningand inference system comprises performing at least one of supervisedlearning and unsupervised learning.
 10. The network transceiver recitedin claim 8, wherein the syntactic structure comprises a structure of atleast one of phrases, clauses, sentences, paragraphs, and conversationformats of the at least one network communication protocol; and at leastone of employing network signal metadata to train and employing theinferred function for mapping comprises performing semantic analysis ofthe metadata.
 11. The network transceiver recited in claim 8, whereinemploying the inferred function for mapping comprises employing at leastone of grammar rules and grammar shapes corresponding to the at leastone network communication protocol to identify a type of data in thedetected network signal.
 12. The network transceiver recited in claim 8,wherein the memory further comprises instructions executable by the atleast one processor for determining content of the detected networksignal from its metadata.
 13. The network transceiver recited in claim8, wherein the mapping further employs at least one of a measured radarcross section; a camera image; an acoustical signature; an infraredsignature; an optical signature; navigation data; video data; networkmanagement data; and a radio signal measurement comprising at least oneof frequency shift, phase offset, delay, angle of arrival, signalstrength, change in frequency shift, change in phase offset, change indelay, change in angle of arrival, change in signal strength.
 14. Thenetwork transceiver recited in claim 8, wherein the memory furthercomprises instructions executable by the at least one processor forassociating received network signals with the transmitter by comparingthe metadata of the detected network signal with location information ofat least one of the transmitter and the transmitter's intended receiver.15. A computer program product, comprising a non-transitorycomputer-readable memory having computer readable program code storedtherein, said computer readable program code containing instructionsexecutable by at least one processor of a computer system for: employingnetwork signal metadata to train a cognitive learning and inferencesystem to produce an inferred function, wherein the metadata comprises asyntactic structure of at least one network communication protocol;employing the inferred function for mapping metadata of a detectednetwork signal to a cognitive profile of a transmitter of the detectednetwork signal, wherein the mapping effects intelligent discriminationof the transmitter from at least one other transmitter throughcorroborative or negating evidentiary observation of propertiesassociated with the metadata of the detected network signal; and basedon the inferred function or the cognitive profile, determininginformation content in the network signal without demodulating thenetwork signal.
 16. The computer program product recited in claim 15,wherein employing the network signal metadata to train the cognitivelearning and inference system comprises performing at least one ofsupervised learning and unsupervised learning.
 17. The computer programproduct recited in claim 15, wherein the syntactic structure comprises astructure of at least one of phrases, clauses, sentences, paragraphs,and conversation formats of the at least one network communicationprotocol; and at least one of employing network signal metadata to trainand employing the inferred function for mapping comprises performingsemantic analysis of the metadata.
 18. The computer program productrecited in claim 15, wherein employing the inferred function for mappingmetadata comprises employing at least one of grammar rules and grammarshapes corresponding to the at least one network communication protocolto identify a type of data in the detected network signal.
 19. Thecomputer program product recited in claim 15, wherein the computerreadable program code further comprises instructions executable by theat least one processor for determining content of the detected networksignal from its metadata.
 20. The computer program product recited inclaim 15, wherein the mapping further employs at least one of a measuredradar cross section; a camera image; an acoustical signature; aninfrared signature; an optical signature; navigation data; video data;network management data; and a radio signal measurement comprising atleast one of frequency shift, phase offset, delay, angle of arrival,signal strength, change in frequency shift, change in phase offset,change in delay, change in angle of arrival, change in signal strength.